@kywi-software/js 0.13.0 → 0.15.0

package/dist/audience/dom-patcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dom-patcher.d.ts","sourceRoot":"","sources":["../../src/audience/dom-patcher.ts"],"names":[],"mappings":"AACA,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAiC7E"}
+{"version":3,"file":"dom-patcher.d.ts","sourceRoot":"","sources":["../../src/audience/dom-patcher.ts"],"names":[],"mappings":"AACA,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAwC7E"}

package/dist/audience/index.d.ts

@@ -26,6 +26,14 @@ export interface AudienceBootConfig {
      * the host page passes the resolved config value through.
      */
     transparencyNotice?: boolean;
+    /**
+     * `theme.personalization.requireConsent` (kywi-cms#91). Defaults to true —
+     * the resolved audience is only remembered for a visitor who consented to
+     * personalization. `false` turns that gate off for a site whose consent is
+     * collected by external tooling; the server applies the same flag, so the two
+     * must agree or the request is made and then refused persistence.
+     */
+    requireConsent?: boolean;
 }
 export declare function bootAudienceEngine(config: AudienceBootConfig): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/audience/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audience/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAA;AASnF,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAGpG,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,QAAQ,EAAE,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACvC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAA;IAC9J,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAUD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+FlF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audience/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAA;AAUnF,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAGpG,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,QAAQ,EAAE,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACvC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAA;IAC9J,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAUD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiIlF"}

package/dist/audience/transparency.d.ts

@@ -31,13 +31,22 @@ export declare function optIn(): void;
 export declare function resetToAutomatic(): void;
 /**
  * Pins the visitor to `audienceId` via the public runtime route — the same
- * endpoint and payload the boot path already uses to persist a client-resolved
- * audience. The server re-validates the id against the active audiences.
+ * endpoint the boot path uses, but marked `source: 'switcher'`. That flag is
+ * what tells the server this is the visitor operating a control by hand rather
+ * than the runtime remembering something automatically, which is why it is
+ * honoured as an `essential` preference and not gated on personalization consent
+ * (kywi-cms#91; the same argument as kywi_optout — see the block above).
+ *
+ * The server re-validates the id against the active audiences.
+ *
+ * Returns whether the pin will SURVIVE this page: false when the server declined
+ * to store it (an older server that predates `source`, or a refusal), so the
+ * caller can say so instead of reloading into an unchanged page.
  */
 export declare function pinAudience(audienceId: string, opts?: {
     apiBase?: string | undefined;
     csrfToken?: string | null | undefined;
-}): Promise<void>;
+}): Promise<boolean>;
 /**
  * Renders (or removes) the transparency surface for `state`. Safe to call on
  * every boot; it replaces whatever is currently mounted.

package/dist/audience/transparency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transparency.d.ts","sourceRoot":"","sources":["../../src/audience/transparency.ts"],"names":[],"mappings":"AAiCA,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,cAAc,EAAE,OAAO,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,8EAA8E;IAC9E,iBAAiB,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAClC,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAoBD,8EAA8E;AAC9E,wBAAgB,WAAW,IAAI,OAAO,CASrC;AAQD,wBAAgB,MAAM,IAAI,IAAI,CAG7B;AAED,wBAAgB,KAAK,IAAI,IAAI,CAE5B;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAMD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAO,GACjF,OAAO,CAAC,IAAI,CAAC,CASf;AAiCD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CA6HtE;AAwBD,kDAAkD;AAClD,wBAAgB,WAAW,IAAI,IAAI,CAGlC;AAED,oFAAoF;AACpF,wBAAgB,aAAa,IAAI,IAAI,CAIpC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAU5C;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C"}
+{"version":3,"file":"transparency.d.ts","sourceRoot":"","sources":["../../src/audience/transparency.ts"],"names":[],"mappings":"AAiCA,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,cAAc,EAAE,OAAO,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,8EAA8E;IAC9E,iBAAiB,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAClC,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAoBD,8EAA8E;AAC9E,wBAAgB,WAAW,IAAI,OAAO,CASrC;AAeD,wBAAgB,MAAM,IAAI,IAAI,CAG7B;AAED,wBAAgB,KAAK,IAAI,IAAI,CAE5B;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAO,GACjF,OAAO,CAAC,OAAO,CAAC,CAkBlB;AA+CD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAqItE;AAwBD,kDAAkD;AAClD,wBAAgB,WAAW,IAAI,IAAI,CAGlC;AAED,oFAAoF;AACpF,wBAAgB,aAAa,IAAI,IAAI,CAIpC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAU5C;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C"}

package/dist/consent.d.ts

@@ -1,5 +1,32 @@
 export declare const CONSENT_COOKIE: "kywi_consent";
+/** The cookie an audience pin lives in. */
+export declare const AUDIENCE_PIN_COOKIE: "kywi_audience";
+/**
+ * The `kywi_audience` value prefix marking a pin the visitor chose BY HAND in
+ * the transparency panel, rather than one the runtime remembered on its own.
+ * Mirrors `SWITCHER_PIN_PREFIX` in core's `audiences/consent.ts`.
+ */
+export declare const SWITCHER_PIN_PREFIX: "switcher:";
 export type ConsentCategory = 'essential' | 'analytics' | 'marketing' | 'personalization';
+/**
+ * Every cookie the engine writes → the consent category it requires.
+ *
+ * A MIRROR of `COOKIE_CONSENT_CATEGORY` in `@kywi-software/core`'s
+ * `audiences/consent.ts`, which is the authority. This package cannot import
+ * core (neither depends on the other), so the copy exists to let a decision made
+ * here REVOKE the cookies it denies without a round trip.
+ * `__tests__/consent-parity.test.ts` asserts the two maps are identical.
+ */
+export declare const COOKIE_CONSENT_CATEGORY: Record<string, ConsentCategory>;
+/** Mirrors `ConsentGateOptions` in core's `audiences/consent.ts`. */
+export interface ConsentGateOptions {
+    /**
+     * `theme.personalization.requireConsent`. Defaults to true. When explicitly
+     * `false` the gate is off and every category reads as allowed — for a site
+     * whose consent is collected by external tooling (kywi-cms#91).
+     */
+    requireConsent?: boolean;
+}
 export interface ConsentState {
     essential: boolean;
     analytics: boolean;
@@ -9,6 +36,19 @@ export interface ConsentState {
 /**
  * Read the current consent state from the `kywi_consent` cookie.
  * Returns the parsed ConsentState, or null if the cookie is missing or malformed.
+ *
+ * The payload is NORMALIZED, not trusted: `essential` is forced true and every
+ * other category is `=== true` or false. The cookie is client-writable, so it
+ * can arrive partial (written by an older version), tampered with, or carrying
+ * `"yes"` where a boolean belongs. Casting it to `ConsentState` and hoping left
+ * callers reading `state.marketing` a truthy string. This mirrors
+ * `parseConsentValue` in core's `audiences/consent.ts` exactly, so the client
+ * and the server can never disagree about what a given cookie means
+ * (`__tests__/consent-parity.test.ts` pins that).
+ *
+ * Unlike core's version this does NOT decodeURIComponent: `readCookies` has
+ * already decoded the value, and decoding twice would corrupt a payload
+ * containing a literal `%`.
  */
 export declare function getConsentState(): ConsentState | null;
 /**
@@ -16,9 +56,36 @@ export declare function getConsentState(): ConsentState | null;
  * The cookie is stored with a 1-year Max-Age.
  */
 export declare function setConsent(prefs: Partial<Omit<ConsentState, 'essential'>>): void;
+/**
+ * Delete every cookie whose category `state` does not grant, and return the
+ * names deleted.
+ *
+ * Refusing to WRITE new cookies is only half of "Reject All": a visitor who
+ * accepted last month and rejects today is still carrying a `kywi_visitor` id,
+ * and a gate that only blocked writes would keep reading it forever
+ * (kywi-cms#91).
+ *
+ * `kywi_signals` is HttpOnly and cannot be removed from script; the attempt is
+ * harmless, the server stops writing it, and it expires on its own 60-second
+ * horizon. Core's server-side read paths also ignore personalization cookies
+ * whenever the gate denies, so a cookie script cannot clear is inert anyway.
+ */
+export declare function clearDeniedCookies(state: ConsentState | null): string[];
 /**
  * Check whether a specific consent category has been granted.
- * Returns false if no consent cookie exists or the category is unknown.
+ *
+ * `essential` is ALWAYS granted, decision or not — necessary cookies (the
+ * consent record itself, the personalization opt-out flag) are never gated, and
+ * before kywi-cms#91 that was true only by accident because nothing called this
+ * function at all. Every other category needs an explicit `true`, so an
+ * undecided visitor grants nothing and an unknown category is denied.
+ *
+ * `requireConsent: false` (from `theme.personalization.requireConsent`) turns the
+ * gate off entirely for a site whose consent is collected by external tooling.
+ *
+ * The authoritative cookie→category map lives in `@kywi-software/core`'s
+ * `audiences/consent.ts` (`COOKIE_CONSENT_CATEGORY`) — this package cannot
+ * import core, so `__tests__/consent-parity.test.ts` asserts the two agree.
  */
-export declare function hasConsent(category: ConsentCategory): boolean;
+export declare function hasConsent(category: ConsentCategory, options?: ConsentGateOptions): boolean;
 //# sourceMappingURL=consent.d.ts.map

package/dist/consent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../src/consent.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,iBAAiB,CAAA;AAEzF,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;CACzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,YAAY,GAAG,IAAI,CAYrD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,GAC9C,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAI7D"}
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../src/consent.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAA;AAE3D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAG,WAAoB,CAAA;AAEvD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,iBAAiB,CAAA;AAEzF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CASnE,CAAA;AAED,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,eAAe,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,IAAI,YAAY,GAAG,IAAI,CAmBrD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,GAC9C,IAAI,CAYN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,EAAE,CAYvE;AAyBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAM/F"}

package/dist/index.d.ts

@@ -23,4 +23,5 @@ export { bootAudienceEngine } from './audience/index.js';
 export { openTransparencyPanel, renderTransparencyPanel, type TransparencyState, type TransparencyAudience, } from './audience/transparency.js';
 export { bootExperiments, type ExperimentRuntime, type ConversionSignal } from './experiments/index.js';
 export { initNavMenus, enhanceNav, NAV_BREAKPOINT } from './nav/menu.js';
+export { getConsentState, setConsent, hasConsent, clearDeniedCookies, COOKIE_CONSENT_CATEGORY, CONSENT_COOKIE, AUDIENCE_PIN_COOKIE, SWITCHER_PIN_PREFIX, type ConsentCategory, type ConsentGateOptions, type ConsentState, } from './consent.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAUnE,KAAK,eAAe,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,IAAI,CAAA;AAIlD,eAAO,MAAM,IAAI;;aAEa,WAAW;YACzB,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACtC,eAAe,GAAG,IAAI;;2BAIb,oBAAoB,GAAG,oBAAoB;;;;oBAM9C,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;4BAC7C,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GAAG,IAAI;;;eAK5C,CAAC,IAAI,EAAE,MAAM,KAAK,GAAG;aACvB,CAAC,IAAI,EAAE,MAAM,KAAK,GAAG;gBAClB,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI;YAC7C,IAAI;CAkBb,CAAA;AAWD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACvG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAUnE,KAAK,eAAe,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,IAAI,CAAA;AAIlD,eAAO,MAAM,IAAI;;aAEa,WAAW;YACzB,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBACtC,eAAe,GAAG,IAAI;;2BAIb,oBAAoB,GAAG,oBAAoB;;;;oBAM9C,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC;4BAC7C,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GAAG,IAAI;;;eAK5C,CAAC,IAAI,EAAE,MAAM,KAAK,GAAG;aACvB,CAAC,IAAI,EAAE,MAAM,KAAK,GAAG;gBAClB,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI;YAC7C,IAAI;CAkBb,CAAA;AAWD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACvG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAIxE,OAAO,EACL,eAAe,EACf,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAA"}

package/dist/kywi.esm.js

@@ -871,7 +871,9 @@ function patchVariantContainers(winningAudienceId) {
     el.removeAttribute("aria-busy");
     const skeleton = el.querySelector(".kywi-variant-skeleton");
     if (skeleton) skeleton.remove();
-    const target = winningAudienceId ?? "default";
+    const requested = winningAudienceId ?? "default";
+    const hasMatch = arms.some((child) => child.getAttribute("data-kywi-variant") === requested);
+    const target = hasMatch ? requested : "default";
     el.setAttribute("data-variant", target);
     for (const child of arms) {
       const h = child;
@@ -966,14 +968,26 @@ function hasPin() {
 async function pinAudience(audienceId, opts = {}) {
   const apiBase = opts.apiBase ?? DEFAULT_API_BASE;
   try {
-    await fetch(`${apiBase}/kywi/audience`, {
+    const res = await fetch(`${apiBase}/kywi/audience`, {
       method: "POST",
       headers: { "Content-Type": "application/json", ...opts.csrfToken ? { "X-CSRF-Token": opts.csrfToken } : {} },
-      body: JSON.stringify({ audienceId })
+      body: JSON.stringify({ audienceId, source: "switcher" })
     });
+    if (!res.ok) return false;
+    const body = await res.json().catch(() => null);
+    return body?.data?.persisted !== false;
   } catch {
+    return false;
   }
 }
+function showSwitcherError(group) {
+  group.parentElement?.querySelector(".kywi-transparency-switcher-error")?.remove();
+  const note = document.createElement("p");
+  note.className = "kywi-transparency-switcher-error";
+  note.setAttribute("role", "status");
+  note.textContent = "Couldn't save that choice. It won't be remembered on the next page.";
+  group.parentElement?.appendChild(note);
+}
 function reload() {
   try {
     window.location.reload();
@@ -1078,7 +1092,12 @@ function renderTransparencyPanel(state) {
       const isCurrent = option.id === state.audienceId;
       const optionBtn = button("kywi-transparency-option", option.name, () => {
         if (isCurrent) return;
-        void pinAudience(option.id, { apiBase: state.apiBase, csrfToken: state.csrfToken }).then(reload);
+        void pinAudience(option.id, { apiBase: state.apiBase, csrfToken: state.csrfToken }).then(
+          (persisted) => {
+            if (persisted) reload();
+            else showSwitcherError(group);
+          }
+        );
       });
       optionBtn.dataset.kywiAudienceId = option.id;
       optionBtn.setAttribute("aria-pressed", String(isCurrent));
@@ -1209,6 +1228,74 @@ function readServerMeta() {
   return { audienceId: m("audience-id"), experimentId: m("experiment-id"), variantId: m("variant-id"), visitorId: m("visitor-id") ?? "" };
 }
 
+// src/consent.ts
+var CONSENT_COOKIE = "kywi_consent";
+var AUDIENCE_PIN_COOKIE = "kywi_audience";
+var SWITCHER_PIN_PREFIX = "switcher:";
+var COOKIE_CONSENT_CATEGORY = {
+  kywi_consent: "essential",
+  kywi_optout: "essential",
+  kywi_preview_init: "essential",
+  kywi_signals: "personalization",
+  kywi_visitor: "personalization",
+  kywi_utm: "personalization",
+  kywi_audience: "personalization",
+  kywi_known: "personalization"
+};
+function getConsentState() {
+  const cookies = readCookies();
+  const raw = cookies.get(CONSENT_COOKIE);
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const obj = parsed;
+  return {
+    essential: true,
+    analytics: obj.analytics === true,
+    marketing: obj.marketing === true,
+    personalization: obj.personalization === true
+  };
+}
+function setConsent(prefs) {
+  const state = {
+    essential: true,
+    analytics: prefs.analytics ?? false,
+    marketing: prefs.marketing ?? false,
+    personalization: prefs.personalization ?? false
+  };
+  setCookie(CONSENT_COOKIE, JSON.stringify(state), 31536e3);
+  clearDeniedCookies(state);
+}
+function clearDeniedCookies(state) {
+  if (typeof document === "undefined") return [];
+  const cookies = readCookies();
+  const deleted = [];
+  for (const [name, category] of Object.entries(COOKIE_CONSENT_CATEGORY)) {
+    if (category === "essential") continue;
+    if (state && state[category] === true) continue;
+    if (isDeliberatePreference(name, cookies.get(name))) continue;
+    deleteCookie(name);
+    deleted.push(name);
+  }
+  return deleted;
+}
+function isDeliberatePreference(name, value) {
+  if (name !== AUDIENCE_PIN_COOKIE || value === void 0) return false;
+  return value.startsWith(SWITCHER_PIN_PREFIX) && value.length > SWITCHER_PIN_PREFIX.length;
+}
+function hasConsent(category, options = {}) {
+  if (options.requireConsent === false) return true;
+  if (category === "essential") return true;
+  const state = getConsentState();
+  if (!state) return false;
+  return state[category] === true;
+}
+
 // src/audience/adapter-runner.ts
 var CACHE_PREFIX = "kywi_adapter_";
 function getCached(adapterId) {
@@ -1554,9 +1641,12 @@ async function bootAudienceEngine(config) {
     return;
   }
   const cookies = readCookies();
+  const consentGate = config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent };
+  const mayPersonalize = hasConsent("personalization", consentGate);
+  const storedVisitorId = mayPersonalize ? cookies.get(COOKIE_NAMES.VISITOR) : void 0;
   let merged = {
     ...serverSignals,
-    identity: { visitorId: serverMeta.visitorId || cookies.get(COOKIE_NAMES.VISITOR) || "", isKnown: cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
+    identity: { visitorId: serverMeta.visitorId || storedVisitorId || "", isKnown: mayPersonalize && cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
     meta: { isOptedOut: cookies.has(COOKIE_NAMES.OPTOUT), isPreview: false, previewAudienceId: null, resolvedAt: "server" }
   };
   if (config.adapters && config.adapters.length > 0) {
@@ -1564,7 +1654,8 @@ async function bootAudienceEngine(config) {
     merged.adapters = { ...merged.adapters, ...adapterResults };
   }
   const result = evaluateClientSide(audiences, merged, currentPath, pageCategory);
-  const pinnedId = cookies.get(COOKIE_NAMES.AUDIENCE) ?? null;
+  const rawPin = cookies.get(COOKIE_NAMES.AUDIENCE) ?? null;
+  const pinnedId = rawPin?.startsWith("switcher:") ? rawPin.slice("switcher:".length) || null : rawPin;
   const isPinned = !result.isOptedOut && pinnedId !== null && activeAudiences.some((a) => a.id === pinnedId);
   const effectiveAudienceId = isPinned ? pinnedId : result.winningAudienceId;
   patchVariantContainers(effectiveAudienceId);
@@ -1581,11 +1672,14 @@ async function bootAudienceEngine(config) {
   renderPersonalizationBadge({ audienceName: nameOf(effectiveAudienceId) });
   populateDataLayer({ visitorId: result.signals.identity.visitorId, audienceId: effectiveAudienceId, experimentId: serverMeta.experimentId, variantId: serverMeta.variantId, isPreview: false, isOptedOut: result.isOptedOut });
   fireKywiReady();
-  if (!isPinned && result.winningAudienceId && result.winningAudienceId !== serverMeta.audienceId) {
+  if (!isPinned && mayPersonalize && result.winningAudienceId && result.winningAudienceId !== serverMeta.audienceId) {
     fetch(`${apiBase}/kywi/audience`, {
       method: "POST",
       headers: { "Content-Type": "application/json", ...Kywi.context?.csrfToken ? { "X-CSRF-Token": Kywi.context.csrfToken } : {} },
-      body: JSON.stringify({ audienceId: result.winningAudienceId })
+      // Explicitly the AUTOMATIC write, so the server applies the
+      // personalization gate to it (kywi-cms#91). The transparency panel's
+      // hand-operated switcher sends source:'switcher' and is exempt.
+      body: JSON.stringify({ audienceId: result.winningAudienceId, source: "boot" })
     }).catch(() => {
     });
   }
@@ -1694,13 +1788,21 @@ if (typeof document !== "undefined") {
   }
 }
 export {
+  AUDIENCE_PIN_COOKIE,
+  CONSENT_COOKIE,
+  COOKIE_CONSENT_CATEGORY,
   Kywi,
   NAV_BREAKPOINT,
+  SWITCHER_PIN_PREFIX,
   bootAudienceEngine,
   bootExperiments,
+  clearDeniedCookies,
   enhanceNav,
+  getConsentState,
+  hasConsent,
   initNavMenus,
   openTransparencyPanel,
-  renderTransparencyPanel
+  renderTransparencyPanel,
+  setConsent
 };
 //# sourceMappingURL=kywi.esm.js.map